{"push_id":2082111538,"size":1000,"distinct_size":1137,"ref":"refs/heads/stage-upstream","head":"08ecd061ae3eb85c46734e9a22c3786f96ec938c","before":"669a330c1044350f122e38c6d594b6f9d56abce3","commits":[{"sha":"02058ba188a25d304adb76712075ae57661f6bda","author":{"name":"Jon Maxwell","email":"3505ad9b6615baed8df57fbb920617eb68a55eb0@gmail.com"},"message":"dccp/tcp: fix routing redirect race\n\ncommit 45caeaa5ac0b4b11784ac6f932c0ad4c6b67cda0 upstream.\n\nAs Eric Dumazet pointed out this also needs to be fixed in IPv6.\nv2: Contains the IPv6 tcp/Ipv6 dccp patches as well.\n\nWe have seen a few incidents lately where a dst_enty has been freed\nwith a dangling TCP socket reference (sk->sk_dst_cache) pointing to that\ndst_entry. If the conditions/timings are right a crash then ensues when the\nfreed dst_entry is referenced later on. A Common crashing back trace is:\n\n #8 [] page_fault at ffffffff8163e648\n    [exception RIP: __tcp_ack_snd_check+74]\n.\n.\n #9 [] tcp_rcv_established at ffffffff81580b64\n#10 [] tcp_v4_do_rcv at ffffffff8158b54a\n#11 [] tcp_v4_rcv at ffffffff8158cd02\n#12 [] ip_local_deliver_finish at ffffffff815668f4\n#13 [] ip_local_deliver at ffffffff81566bd9\n#14 [] ip_rcv_finish at ffffffff8156656d\n#15 [] ip_rcv at ffffffff81566f06\n#16 [] __netif_receive_skb_core at ffffffff8152b3a2\n#17 [] __netif_receive_skb at ffffffff8152b608\n#18 [] netif_receive_skb at ffffffff8152b690\n#19 [] vmxnet3_rq_rx_complete at ffffffffa015eeaf [vmxnet3]\n#20 [] vmxnet3_poll_rx_only at ffffffffa015f32a [vmxnet3]\n#21 [] net_rx_action at ffffffff8152bac2\n#22 [] __do_softirq at ffffffff81084b4f\n#23 [] call_softirq at ffffffff8164845c\n#24 [] do_softirq at ffffffff81016fc5\n#25 [] irq_exit at ffffffff81084ee5\n#26 [] do_IRQ at ffffffff81648ff8\n\nOf course it may happen with other NIC drivers as well.\n\nIt's found the freed dst_entry here:\n\n 224 static bool tcp_in_quickack_mode(struct sock *sk)↩\n 225 {↩\n 226 ▹       const struct inet_connection_sock *icsk = inet_csk(sk);↩\n 227 ▹       const struct dst_entry *dst = __sk_dst_get(sk);↩\n 228 ↩\n 229 ▹       return (dst && dst_metric(dst, RTAX_QUICKACK)) ||↩\n 230 ▹       ▹       (icsk->icsk_ack.quick && !icsk->icsk_ack.pingpong);↩\n 231 }↩\n\nBut there are other backtraces attributed to the same freed dst_entry in\nnetfilter code as well.\n\nAll the vmcores showed 2 significant clues:\n\n- Remote hosts behind the default gateway had always been redirected to a\ndifferent gateway. A rtable/dst_entry will be added for that host. Making\nmore dst_entrys with lower reference counts. Making this more probable.\n\n- All vmcores showed a postitive LockDroppedIcmps value, e.g:\n\nLockDroppedIcmps                  267\n\nA closer look at the tcp_v4_err() handler revealed that do_redirect() will run\nregardless of whether user space has the socket locked. This can result in a\nrace condition where the same dst_entry cached in sk->sk_dst_entry can be\ndecremented twice for the same socket via:\n\ndo_redirect()->__sk_dst_check()-> dst_release().\n\nWhich leads to the dst_entry being prematurely freed with another socket\npointing to it via sk->sk_dst_cache and a subsequent crash.\n\nTo fix this skip do_redirect() if usespace has the socket locked. Instead let\nthe redirect take place later when user space does not have the socket\nlocked.\n\nThe dccp/IPv6 code is very similar in this respect, so fixing it there too.\n\nAs Eric Garver pointed out the following commit now invalidates routes. Which\ncan set the dst->obsolete flag so that ipv4_dst_check() returns null and\ntriggers the dst_release().\n\nFixes: ceb3320610d6 (\"ipv4: Kill routes during PMTU/redirect updates.\")\nCc: Eric Garver <egarver@redhat.com>\nCc: Hannes Sowa <hsowa@redhat.com>\nSigned-off-by: Jon Maxwell <jmaxwell37@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/02058ba188a25d304adb76712075ae57661f6bda"},{"sha":"42f6b7b9fcd9ba6c62c624c78cf17763e4532f79","author":{"name":"Hannes Frederic Sowa","email":"384333b8ca49bccf53afadd43ca0007cb9efc1df@stressinduktion.org"},"message":"dccp: fix memory leak during tear-down of unsuccessful connection request\n\ncommit 72ef9c4125c7b257e3a714d62d778ab46583d6a3 upstream.\n\nThis patch fixes a memory leak, which happens if the connection request\nis not fulfilled between parsing the DCCP options and handling the SYN\n(because e.g. the backlog is full), because we forgot to free the\nlist of ack vectors.\n\nReported-by: Jianwen Ji <jiji@redhat.com>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/42f6b7b9fcd9ba6c62c624c78cf17763e4532f79"},{"sha":"aad2e655648c55f4368fdb11e03f7460121f826c","author":{"name":"Geert Uytterhoeven","email":"6ab3568c168343bc5fcca77fbd6a3d6e63ce9838@linux-m68k.org"},"message":"Input: gscps2 - fix MODULE_DEVICE_TABLE invocation\n\ncommit 6c8afa88adce613c23f27e719f805cc2a6441b07 upstream.\n\nThe patch \"module: fix types of device tables aliases\" newly requires\nthat invocations of\n\nMODULE_DEVICE_TABLE(type, name);\n\ncome *after* the definition of `name'.  That is reasonable, but gscps2\nwasn't doing this.  Fix it.\n\nSigned-off-by: Geert Uytterhoeven <geert@linux-m68k.org>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nCc: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/aad2e655648c55f4368fdb11e03f7460121f826c"},{"sha":"56e1446335af73dbfa98ef3a2122ea766890aebf","author":{"name":"Greg Kroah-Hartman","email":"4931344b09d7a7d3573e8b1ebec918e229ead9bf@linuxfoundation.org"},"message":"Linux 3.18.49","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/56e1446335af73dbfa98ef3a2122ea766890aebf"},{"sha":"fedc3164eebb3611de479befc1eaad75f6fad79a","author":{"name":"Germano Percossi","email":"e91305baea6ecceb12f5006cd51cb0ad0b3eacbe@citrix.com"},"message":"CIFS: store results of cifs_reopen_file to avoid infinite wait\n\ncommit 1fa839b4986d648b907d117275869a0e46c324b9 upstream.\n\nThis fixes Continuous Availability when errors during\nfile reopen are encountered.\n\ncifs_user_readv and cifs_user_writev would wait for ever if\nresults of cifs_reopen_file are not stored and for later inspection.\n\nIn fact, results are checked and, in case of errors, a chain\nof function calls leading to reads and writes to be scheduled in\na separate thread is skipped.\nThese threads will wake up the corresponding waiters once reads\nand writes are done.\n\nHowever, given the return value is not stored, when rc is checked\nfor errors a previous one (always zero) is inspected instead.\nThis leads to pending reads/writes added to the list, making\ncifs_user_readv and cifs_user_writev wait for ever.\n\nSigned-off-by: Germano Percossi <germano.percossi@citrix.com>\nReviewed-by: Pavel Shilovsky <pshilov@microsoft.com>\nSigned-off-by: Steve French <smfrench@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/fedc3164eebb3611de479befc1eaad75f6fad79a"},{"sha":"275708327ab7c447eee06c8aa882da1c696b9519","author":{"name":"Cameron Gutman","email":"dae64e07afda5ec299f6c7de821d7927f9ed1853@gmail.com"},"message":"Input: xpad - add support for Razer Wildcat gamepad\n\ncommit 5376366886251e2f8f248704adb620a4bc4c0937 upstream.\n\nSigned-off-by: Cameron Gutman <aicommander@gmail.com>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/275708327ab7c447eee06c8aa882da1c696b9519"},{"sha":"6b2ca6f4b7fb719c55f1d63380884ebebb9c99b4","author":{"name":"Peter Zijlstra","email":"4d3106856cce90e8f40acc5180f60ddda3a23b6e@infradead.org"},"message":"perf/x86: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32()\n\ncommit f2200ac311302fcdca6556fd0c5127eab6c65a3e upstream.\n\nWhen the perf_branch_entry::{in_tx,abort,cycles} fields were added,\nintel_pmu_lbr_read_32() wasn't updated to initialize them.\n\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: linux-kernel@vger.kernel.org\nFixes: 135c5612c460 (\"perf/x86/intel: Support Haswell/v4 LBR format\")\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/6b2ca6f4b7fb719c55f1d63380884ebebb9c99b4"},{"sha":"7430a7ef9e37145e19cf6909ebbb4445cd594feb","author":{"name":"Thomas Gleixner","email":"352b5f5ba0189d2583768a9bb8247f98115b9038@linutronix.de"},"message":"x86/vdso: Plug race between mapping and ELF header setup\n\ncommit 6fdc6dd90272ce7e75d744f71535cfbd8d77da81 upstream.\n\nThe vsyscall32 sysctl can racy against a concurrent fork when it switches\nfrom disabled to enabled:\n\n    arch_setup_additional_pages()\n\tif (vdso32_enabled)\n           --> No mapping\n                                        sysctl.vsysscall32()\n                                          --> vdso32_enabled = true\n    create_elf_tables()\n      ARCH_DLINFO_IA32\n        if (vdso32_enabled) {\n           --> Add VDSO entry with NULL pointer\n\nMake ARCH_DLINFO_IA32 check whether the VDSO mapping has been set up for\nthe newly forked process or not.\n\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nAcked-by: Andy Lutomirski <luto@amacapital.net>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Mathias Krause <minipli@googlemail.com>\nLink: http://lkml.kernel.org/r/20170410151723.602367196@linutronix.de\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/7430a7ef9e37145e19cf6909ebbb4445cd594feb"},{"sha":"e973358906a3a69a58eed7cd988788ed7126723f","author":{"name":"Mathias Krause","email":"c0f5a800b69cdfd927790b9eec175d77c6a1b20d@googlemail.com"},"message":"x86/vdso: Ensure vdso32_enabled gets set to valid values only\n\ncommit c06989da39cdb10604d572c8c7ea8c8c97f3c483 upstream.\n\nvdso_enabled can be set to arbitrary integer values via the kernel command\nline 'vdso32=' parameter or via 'sysctl abi.vsyscall32'.\n\nload_vdso32() only maps VDSO if vdso_enabled == 1, but ARCH_DLINFO_IA32\nmerily checks for vdso_enabled != 0. As a consequence the AT_SYSINFO_EHDR\nauxiliary vector for the VDSO_ENTRY is emitted with a NULL pointer which\ncauses a segfault when the application tries to use the VDSO.\n\nRestrict the valid arguments on the command line and the sysctl to 0 and 1.\n\nFixes: b0b49f2673f0 (\"x86, vdso: Remove compat vdso support\")\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nAcked-by: Andy Lutomirski <luto@amacapital.net>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Roland McGrath <roland@redhat.com>\nLink: http://lkml.kernel.org/r/1491424561-7187-1-git-send-email-minipli@googlemail.com\nLink: http://lkml.kernel.org/r/20170410151723.518412863@linutronix.de\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/e973358906a3a69a58eed7cd988788ed7126723f"},{"sha":"4c4b6ebbee6aef089bc446793983009e6facaf9d","author":{"name":"Nicholas Bellinger","email":"79a5e6cd70ccff08412e5a88129ccc53c0a7b045@linux-iscsi.org"},"message":"iscsi-target: Fix TMR reference leak during session shutdown\n\ncommit efb2ea770bb3b0f40007530bc8b0c22f36e1c5eb upstream.\n\nThis patch fixes a iscsi-target specific TMR reference leak\nduring session shutdown, that could occur when a TMR was\nquiesced before the hand-off back to iscsi-target code\nvia transport_cmd_check_stop_to_fabric().\n\nThe reference leak happens because iscsit_free_cmd() was\nincorrectly skipping the final target_put_sess_cmd() for\nTMRs when transport_generic_free_cmd() returned zero because\nthe se_cmd->cmd_kref did not reach zero, due to the missing\nse_cmd assignment in original code.\n\nThe result was iscsi_cmd and it's associated se_cmd memory\nwould be freed once se_sess->sess_cmd_map where released,\nbut the associated se_tmr_req was leaked and remained part\nof se_device->dev_tmr_list.\n\nThis bug would manfiest itself as kernel paging request\nOOPsen in core_tmr_lun_reset(), when a left-over se_tmr_req\nattempted to dereference it's se_cmd pointer that had\nalready been released during normal session shutdown.\n\nTo address this bug, go ahead and treat ISCSI_OP_SCSI_CMD\nand ISCSI_OP_SCSI_TMFUNC the same when there is an extra\nse_cmd->cmd_kref to drop in iscsit_free_cmd(), and use\nop_scsi to signal __iscsit_free_cmd() when the former\nneeds to clear any further iscsi related I/O state.\n\nReported-by: Rob Millner <rlm@daterainc.com>\nCc: Rob Millner <rlm@daterainc.com>\nReported-by: Chu Yuan Lin <cyl@datera.io>\nCc: Chu Yuan Lin <cyl@datera.io>\nTested-by: Chu Yuan Lin <cyl@datera.io>\nSigned-off-by: Nicholas Bellinger <nab@linux-iscsi.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/4c4b6ebbee6aef089bc446793983009e6facaf9d"},{"sha":"8788aff638559b3596eed60766c895a3dae538d3","author":{"name":"Nicholas Bellinger","email":"79a5e6cd70ccff08412e5a88129ccc53c0a7b045@linux-iscsi.org"},"message":"iscsi-target: Drop work-around for legacy GlobalSAN initiator\n\ncommit 1c99de981f30b3e7868b8d20ce5479fa1c0fea46 upstream.\n\nOnce upon a time back in 2009, a work-around was added to support\nthe GlobalSAN iSCSI initiator v3.3 for MacOSX, which during login\ndid not propose nor respond to MaxBurstLength, FirstBurstLength,\nDefaultTime2Wait and DefaultTime2Retain keys.\n\nThe work-around in iscsi_check_proposer_for_optional_reply()\nallowed the missing keys to be proposed, but did not require\nwaiting for a response before moving to full feature phase\noperation.  This allowed GlobalSAN v3.3 to work out-of-the\nbox, and for many years we didn't run into login interopt\nissues with any other initiators..\n\nUntil recently, when Martin tried a QLogic 57840S iSCSI Offload\nHBA on Windows 2016 which completed login, but subsequently\nfailed with:\n\n    Got unknown iSCSI OpCode: 0x43\n\nThe issue was QLogic MSFT side did not propose DefaultTime2Wait +\nDefaultTime2Retain, so LIO proposes them itself, and immediately\ntransitions to full feature phase because of the GlobalSAN hack.\nHowever, the QLogic MSFT side still attempts to respond to\nDefaultTime2Retain + DefaultTime2Wait, even though LIO has set\nISCSI_FLAG_LOGIN_NEXT_STAGE3 + ISCSI_FLAG_LOGIN_TRANSIT\nin last login response.\n\nSo while the QLogic MSFT side should have been proposing these\ntwo keys to start, it was doing the correct thing per RFC-3720\nattempting to respond to proposed keys before transitioning to\nfull feature phase.\n\nAll that said, recent versions of GlobalSAN iSCSI (v5.3.0.541)\ndoes correctly propose the four keys during login, making the\noriginal work-around moot.\n\nSo in order to allow QLogic MSFT to run unmodified as-is, go\nahead and drop this long standing work-around.\n\nReported-by: Martin Svec <martin.svec@zoner.cz>\nCc: Martin Svec <martin.svec@zoner.cz>\nCc: Himanshu Madhani <Himanshu.Madhani@cavium.com>\nCc: Arun Easi <arun.easi@cavium.com>\nSigned-off-by: Nicholas Bellinger <nab@linux-iscsi.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/8788aff638559b3596eed60766c895a3dae538d3"},{"sha":"3f6bc55e80974cca616b6f92542f14ae13f663bc","author":{"name":"Martin K. Petersen","email":"4e2cf5906578343a955836ae62857d72aa7256f7@oracle.com"},"message":"scsi: sr: Sanity check returned mode data\n\ncommit a00a7862513089f17209b732f230922f1942e0b9 upstream.\n\nKefeng Wang discovered that old versions of the QEMU CD driver would\nreturn mangled mode data causing us to walk off the end of the buffer in\nan attempt to parse it. Sanity check the returned mode sense data.\n\nReported-by: Kefeng Wang <wangkefeng.wang@huawei.com>\nTested-by: Kefeng Wang <wangkefeng.wang@huawei.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/3f6bc55e80974cca616b6f92542f14ae13f663bc"},{"sha":"41dd18c5cb312a5fd0ba17835629caa339771890","author":{"name":"Martin K. Petersen","email":"4e2cf5906578343a955836ae62857d72aa7256f7@oracle.com"},"message":"scsi: sd: Fix capacity calculation with 32-bit sector_t\n\ncommit 7c856152cb92f8eee2df29ef325a1b1f43161aff upstream.\n\nWe previously made sure that the reported disk capacity was less than\n0xffffffff blocks when the kernel was not compiled with large sector_t\nsupport (CONFIG_LBDAF). However, this check assumed that the capacity\nwas reported in units of 512 bytes.\n\nAdd a sanity check function to ensure that we only enable disks if the\nentire reported capacity can be expressed in terms of sector_t.\n\nReported-by: Steve Magnani <steve.magnani@digidescorp.com>\nCc: Bart Van Assche <Bart.VanAssche@sandisk.com>\nReviewed-by: Bart Van Assche <Bart.VanAssche@sandisk.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/41dd18c5cb312a5fd0ba17835629caa339771890"},{"sha":"f7b2918479cc99ed802389b2e7d049907ab42365","author":{"name":"Juergen Gross","email":"d3dfe5c5fac772d904d4932d138136d040bb63c7@suse.com"},"message":"xen, fbfront: fix connecting to backend\n\ncommit 9121b15b5628b38b4695282dc18c553440e0f79b upstream.\n\nConnecting to the backend isn't working reliably in xen-fbfront: in\ncase XenbusStateInitWait of the backend has been missed the backend\ntransition to XenbusStateConnected will trigger the connected state\nonly without doing the actions required when the backend has\nconnected.\n\nSigned-off-by: Juergen Gross <jgross@suse.com>\nReviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nSigned-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/f7b2918479cc99ed802389b2e7d049907ab42365"},{"sha":"ac7df51015589881b1a294f427d6097d5d63385f","author":{"name":"Steven Rostedt (VMware)","email":"9f626a07de58780741a9085807c77fd646ef3459@goodmis.org"},"message":"ftrace: Fix removing of second function probe\n\ncommit 82cc4fc2e70ec5baeff8f776f2773abc8b2cc0ae upstream.\n\nWhen two function probes are added to set_ftrace_filter, and then one of\nthem is removed, the update to the function locations is not performed, and\nthe record keeping of the function states are corrupted, and causes an\nftrace_bug() to occur.\n\nThis is easily reproducable by adding two probes, removing one, and then\nadding it back again.\n\n # cd /sys/kernel/debug/tracing\n # echo schedule:traceoff > set_ftrace_filter\n # echo do_IRQ:traceoff > set_ftrace_filter\n # echo \\!do_IRQ:traceoff > /debug/tracing/set_ftrace_filter\n # echo do_IRQ:traceoff > set_ftrace_filter\n\nCauses:\n ------------[ cut here ]------------\n WARNING: CPU: 2 PID: 1098 at kernel/trace/ftrace.c:2369 ftrace_get_addr_curr+0x143/0x220\n Modules linked in: [...]\n CPU: 2 PID: 1098 Comm: bash Not tainted 4.10.0-test+ #405\n Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v02.05 05/07/2012\n Call Trace:\n  dump_stack+0x68/0x9f\n  __warn+0x111/0x130\n  ? trace_irq_work_interrupt+0xa0/0xa0\n  warn_slowpath_null+0x1d/0x20\n  ftrace_get_addr_curr+0x143/0x220\n  ? __fentry__+0x10/0x10\n  ftrace_replace_code+0xe3/0x4f0\n  ? ftrace_int3_handler+0x90/0x90\n  ? printk+0x99/0xb5\n  ? 0xffffffff81000000\n  ftrace_modify_all_code+0x97/0x110\n  arch_ftrace_update_code+0x10/0x20\n  ftrace_run_update_code+0x1c/0x60\n  ftrace_run_modify_code.isra.48.constprop.62+0x8e/0xd0\n  register_ftrace_function_probe+0x4b6/0x590\n  ? ftrace_startup+0x310/0x310\n  ? debug_lockdep_rcu_enabled.part.4+0x1a/0x30\n  ? update_stack_state+0x88/0x110\n  ? ftrace_regex_write.isra.43.part.44+0x1d3/0x320\n  ? preempt_count_sub+0x18/0xd0\n  ? mutex_lock_nested+0x104/0x800\n  ? ftrace_regex_write.isra.43.part.44+0x1d3/0x320\n  ? __unwind_start+0x1c0/0x1c0\n  ? _mutex_lock_nest_lock+0x800/0x800\n  ftrace_trace_probe_callback.isra.3+0xc0/0x130\n  ? func_set_flag+0xe0/0xe0\n  ? __lock_acquire+0x642/0x1790\n  ? __might_fault+0x1e/0x20\n  ? trace_get_user+0x398/0x470\n  ? strcmp+0x35/0x60\n  ftrace_trace_onoff_callback+0x48/0x70\n  ftrace_regex_write.isra.43.part.44+0x251/0x320\n  ? match_records+0x420/0x420\n  ftrace_filter_write+0x2b/0x30\n  __vfs_write+0xd7/0x330\n  ? do_loop_readv_writev+0x120/0x120\n  ? locks_remove_posix+0x90/0x2f0\n  ? do_lock_file_wait+0x160/0x160\n  ? __lock_is_held+0x93/0x100\n  ? rcu_read_lock_sched_held+0x5c/0xb0\n  ? preempt_count_sub+0x18/0xd0\n  ? __sb_start_write+0x10a/0x230\n  ? vfs_write+0x222/0x240\n  vfs_write+0xef/0x240\n  SyS_write+0xab/0x130\n  ? SyS_read+0x130/0x130\n  ? trace_hardirqs_on_caller+0x182/0x280\n  ? trace_hardirqs_on_thunk+0x1a/0x1c\n  entry_SYSCALL_64_fastpath+0x18/0xad\n RIP: 0033:0x7fe61c157c30\n RSP: 002b:00007ffe87890258 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n RAX: ffffffffffffffda RBX: ffffffff8114a410 RCX: 00007fe61c157c30\n RDX: 0000000000000010 RSI: 000055814798f5e0 RDI: 0000000000000001\n RBP: ffff8800c9027f98 R08: 00007fe61c422740 R09: 00007fe61ca53700\n R10: 0000000000000073 R11: 0000000000000246 R12: 0000558147a36400\n R13: 00007ffe8788f160 R14: 0000000000000024 R15: 00007ffe8788f15c\n  ? trace_hardirqs_off_caller+0xc0/0x110\n ---[ end trace 99fa09b3d9869c2c ]---\n Bad trampoline accounting at: ffffffff81cc3b00 (do_IRQ+0x0/0x150)\n\nFixes: 59df055f1991 (\"ftrace: trace different functions with a different tracer\")\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/ac7df51015589881b1a294f427d6097d5d63385f"},{"sha":"b9f7e3a98eb540d781c5d9d79095cf1bda75b6dd","author":{"name":"Geert Uytterhoeven","email":"6ab3568c168343bc5fcca77fbd6a3d6e63ce9838@linux-m68k.org"},"message":"char: Drop bogus dependency of DEVPORT on !M68K\n\ncommit 309124e2648d668a0c23539c5078815660a4a850 upstream.\n\nAccording to full-history-linux commit d3794f4fa7c3edc3 (\"[PATCH] M68k\nupdate (part 25)\"), port operations are allowed on m68k if CONFIG_ISA is\ndefined.\n\nHowever, commit 153dcc54df826d2f (\"[PATCH] mem driver: fix conditional\non isa i/o support\") accidentally changed an \"||\" into an \"&&\",\ndisabling it completely on m68k. This logic was retained when\nintroducing the DEVPORT symbol in commit 4f911d64e04a44c4 (\"Make\n/dev/port conditional on config symbol\").\n\nDrop the bogus dependency on !M68K to fix this.\n\nFixes: 153dcc54df826d2f (\"[PATCH] mem driver: fix conditional on isa i/o support\")\nSigned-off-by: Geert Uytterhoeven <geert@linux-m68k.org>\nTested-by: Al Stone <ahs3@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/b9f7e3a98eb540d781c5d9d79095cf1bda75b6dd"},{"sha":"5b8def94af5603a8aba802505ccf32c5b09f613e","author":{"name":"Max Bires","email":"102f1af3c0fbbf60f83a5ad4e747d8b0816b7fc1@google.com"},"message":"char: lack of bool string made CONFIG_DEVPORT always on\n\ncommit f2cfa58b136e4b06a9b9db7af5ef62fbb5992f62 upstream.\n\nWithout a bool string present, using \"# CONFIG_DEVPORT is not set\" in\ndefconfig files would not actually unset devport. This esnured that\n/dev/port was always on, but there are reasons a user may wish to\ndisable it (smaller kernel, attack surface reduction) if it's not being\nused. Adding a message here in order to make this user visible.\n\nSigned-off-by: Max Bires <jbires@google.com>\nAcked-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/5b8def94af5603a8aba802505ccf32c5b09f613e"},{"sha":"e5150551f96a5b170183ac6580d4a05e99a71bdb","author":{"name":"Amit Pundir","email":"afbf329241dfb55d52837a86a84bc563d5e8c629@linaro.org"},"message":"Revert \"ARM: 8457/1: psci-smp is built only for SMP\"\n\nThis reverts commit dbcfee724255ae171af51aaa56d8c5b78342adc9 which is\ncommit be95485a0b8288a93402705730d3ea32f9f812b9 upstream.\n\nUpstream commit be95485 (ARM: 8457/1: psci-smp is built only for SMP)\nwas intended to fix the build error for configs with CONFIG_SMP=n and\nCONFIG_ARM_PSCI=y, but it end up introducing a build error when\ncherry-picked on 3.18.y.\n\nThis patch resulted in redefinition of psci_init() and broke the\nbuild for every build config in 3.18.y with CONFIG_SMP=n and\nCONFIG_ARM_PSCI=y.\n\nSigned-off-by: Amit Pundir <amit.pundir@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/e5150551f96a5b170183ac6580d4a05e99a71bdb"},{"sha":"8fdc5581a42b1b199532e2e58d85e205e7502b59","author":{"name":"Paolo Bonzini","email":"7438500e0207b21c4e5dfca8d2a7898734cd7706@redhat.com"},"message":"kvm: fix page struct leak in handle_vmon\n\ncommit 06ce521af9558814b8606c0476c54497cf83a653 upstream.\n\nhandle_vmon gets a reference on VMXON region page,\nbut does not release it. Release the reference.\n\nFound by syzkaller; based on a patch by Dmitry.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\n[bwh: Backported to 3.16: use skip_emulated_instruction()]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/8fdc5581a42b1b199532e2e58d85e205e7502b59"},{"sha":"2c7446882e0a805b392603aae63b98be6bd24065","author":{"name":"Thomas Hellstrom","email":"8b2fec8936df9aec80ca2921a4040d54bb192003@vmware.com"},"message":"drm/vmwgfx: Type-check lookups of fence objects\n\ncommit f7652afa8eadb416b23eb57dec6f158529942041 upstream.\n\nA malicious caller could otherwise hand over handles to other objects\ncausing all sorts of interesting problems.\n\nTesting done: Ran a Fedora 25 desktop using both Xorg and\ngnome-shell/Wayland.\n\nSigned-off-by: Thomas Hellstrom <thellstrom@vmware.com>\nReviewed-by: Sinclair Yeh <syeh@vmware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/jancokOS/android_kernel_oneplus_msm8996/commits/2c7446882e0a805b392603aae63b98be6bd24065"}]}
{"actor":{"display_login":"bibahR"}}